CVE-2022-22616
Published: 26 May 2022
Summary
CVE-2022-22616 is a medium-severity an unspecified weakness vulnerability in Apple Mac Os X. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-22616 is a Gatekeeper bypass vulnerability affecting macOS Catalina, macOS Big Sur 11.6.5, and macOS Monterey 12.3. The flaw stems from insufficient validation checks that allow a maliciously crafted ZIP archive to evade Gatekeeper's signature and notarization enforcement when the archive is processed on the system.
An attacker can supply the crafted ZIP to a local user, who must then interact with it for the bypass to occur. Successful exploitation permits unsigned or unnotarized code to execute without triggering Gatekeeper warnings, resulting in integrity impact on the affected host while requiring no elevated privileges.
Apple's security advisories for HT213183, HT213184, and HT213185 state that the issue was resolved through improved checks delivered in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5, and macOS Monterey 12.3. The EPSS score reached a peak of 0.2135 with a current value of 0.1793, indicating moderate and relatively stable exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27761
Vulnerability details
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.